FlightTECH

© Chris Sorensen Photography

Autoflight Audit

By Wayne Rosenkrans

Check-up targets
efforts to mitigate
complexity of flight
guidance systems.

T
he Flight Deck Automation Working
Group, a U.S. government-industry com-
mittee launched in 2006, is scheduled
to complete next year an assessment of
how well airlines have addressed safety vulner-
abilities identified in flight deck automation,
including the effectiveness of efforts to improve
mode awareness during autopilot/flight director
operation and to mitigate mode confusion.
Mode awareness/confusion has been de-
scribed as situations in which “the flight crew
believe they are in a [flight guidance system]
mode different than the one they are actually in
and consequently make inappropriate requests
or responses to the automation” or in which
“the flight crew does not fully understand the
behavior of the automation in certain modes, i.e.,
when the crew have a poor ‘mental model’ of the
automation.”1 Sometimes, this is simply called
losing track of the automation.
The subject has been studied for decades.
“The current set of autoflight modes is large and

30 | flight safety foundation | AEroSafetyWorld | June 2008

 FlightTECH

has expanded over the years: A typical
transport may have approximately 25
thrust, lateral and vertical modes,” said
a 2004 report by Boeing Commercial
Airplanes researchers. “The complex
rules behind vertical navigation and
other modes sometimes make it dif-
ficult for pilots to anticipate aircraft
flight path behavior. … Boeing research
shows that some pilots incorrectly as-
sume that all vertical navigation modes
always take altitude targets from the
flight plan [programmed into the flight
management system]. … Although the
flight mode annunciation on the prima-
ry flight display highlights changes with
a transient green box, Boeing research
indicates that 30–40 percent of these
changes go undetected.”2
Previous solutions primarily focused
on policies, procedures and training
pending the adoption of new airwor-
thiness standards for flight guidance
systems — completed in 2006 in the
United States — and the arrival of more
human-centered flight deck technology.
The airline accident most often
cited for raising consciousness of the
mode awareness/confusion issue oc-
curred in April 1994 when the flight
specified types of operators, optimize
pilot training, among other objectives.
The FAA said in May 2008 that this
PARC/CAST working group is mak-
ing progress but could not yet discuss
its ongoing deliberations. In earlier
communication, however, the work-
ing group said, “In the past decade,
major improvements have been made
in the design, training and operational
use of on-board systems for flight path
management (autopilot, flight director,
flight management systems, etc. and
their associated flight crew interfaces
[Figure 1]). In spite of these improve-
ments, incident reports suggest that
flight crews continue to have problems
interfacing with the automation and
have difficulty using these systems.
But appropriate use of automation by
the flight crew is critical to safety and
to effective implementation of new
operational concepts, such as required
Flight Control System Automation Overview
Crew interface
Flight control
panel
Crew
selections1
navigation performance (RNP) and
area navigation (RNAV).”
The working group also said that its
scope of work includes updating and
revising safety recommendations from
a June 1996 report by the FAA Human
Factors Team,3 reviewing airline crews’
recent experience with flight deck sys-
tems in situations such as RNP RNAV
approaches and departures, analyz-
ing recent accident/incident data, and
recommending and prioritizing best
practices — possibly via a training aid
— to enhance operational use of these
systems.
Ten years ago, the Automation Sub-
committee of the Human Factors Com-
mittee of the Air Transport Association
of America (ATA) updated policy
guidance for members on potential im-
provements in pilot training. The ATA
said at the time, “We believe that action
is required in the near term by carriers
Primary flight
displays
Crew
indications2

crew of an Airbus A300 experienced Flight guidance system On/off Flight director
guidance cues
loss of control and crashed during (Electronic flight
an approach to Nagoya, Japan (ASW, Mode logic Roll instrument system)
Flight guidance
10/06, p. 44). The U.S. Federal Aviation management
system Pitch
Administration (FAA) later said, “Con- Flight control guidance
laws
tributing to that accident were conflict- Actuator Control
Autopilot
surfaces
ing actions taken by the flight crew and Engage/
disengage
commands

the airplane’s autopilot.”

Measured state

A Broad Assessment Aircraft state

Established by the Performance-Based
Operations Aviation Rulemaking
Committee (PARC) and the U.S. Com-
mercial Aviation Safety Team (CAST),
the Flight Deck Automation Working
Group’s findings and recommendations
are expected to help airlines, and other
sensor data
Notes
1. Buttons pressed and knobs set on flight control panel.
2. Indicator lamps illuminated/off on flight control panel and green/white textual mode annunciations
on primary flight displays.
Source: Langley Research Center, U.S. National Aeronautics and Space Administration
Figure 1

www.flightsafety.org | AeroSafetyWorld | June 2008 | 31

 FlightTECH
or their pilots to prevent commonly
occurring [mode] errors.”4
More recent incentives to sustain
industry attention to mode awareness/
confusion include an international
initiative to replace nonprecision ap-
proaches with “precision-like” ap-
proaches that take full advantage of
the existing flight guidance systems in
airline fleets, RNP RNAV operation
and global navigation satellite systems
in areas of the world that lack modern
infrastructure and precision approach
guidance (ASW, 9/07, p. 20).
The Global Aviation Safety Road-
map (ASW, 1/07, p. 28) also envisions
wider use of autoflight technology. The
plan encourages airlines to implement
use of a flight path target–flight path
director or vertical modes of the auto-
pilot, flight director and flight manage-
ment system, or both, to reduce the risk
of approach-and-landing accidents.
These efforts may have to overcome
existing automation policies prohibiting
pilots from using some flight guidance
system modes and/or requiring them to
use other modes.5
Latest Pilot Reports
The captain of a Boeing 757, in a Febru-
ary 2007 report to the U.S. National
Aeronautics and Space Administration
(NASA) Aviation Safety Reporting
Generic Flight Control Panel for Human Factors Research
ALT = altitude hold mode/altitude selector; AP ENG = autopilot engage/disengage; CRS = course selector; FD = flight director on/off; FLC = flight level change
mode; HDG = heading select mode/heading selector; APPR = lateral approach mode; NAV = lateral navigation mode; VS = vertical speed mode
Source: Langley Research Center, U.S. National Aeronautics and Space Administration
Figure 2
32 |
System (ASRS), said, “Upon receiving
approach clearance [at 10,000 ft on radar
vectors], the first officer [as pilot flying]
selected 6,100 ft … on the airplane
mode control panel [manufacturers use
different terms, including flight control
panel (Figure 2)], and flight level change
[as] the descent mode. Flight level
change [mode] provided no protection
for subsequent altitude restrictions on
the approach. I was verifying the flight
management system programming and
ascertaining the aircraft position rela-
tive to ATANE intersection (minimum
crossing altitude 10,000 ft MSL) as we
began our descent. The aircraft was at
approximately 9,400 ft slightly outside
ATANE when I directed the first officer
to pull up.”6
The captain of a McDonnell Doug-
las DC-9 in February 2007 reported,
“After leveling at Flight Level 340 [ap-
proximately 34,000 ft], my first officer
(the pilot flying) … wiped his fingers,
the throttles and the autopilot [mode]
control panel with a wet wipe [and]
inadvertently knocked the autopilot
out of the altitude hold mode and
into climb mode. We did not imme-
diately notice the slow climb because
of continuous light turbulence. When
the altitude alerter [activated] at 34,250
ft, the first officer disconnected the
autopilot and descended back to Flight
Level 340. The altitude deviation was
probably about 300 ft [in reduced verti-
cal separation minimum airspace when
ATC contacted the crew].”7
The captain of a 737-700 in Decem-
ber 2007 reported, “[As pilot flying, I]
had the aircraft in heading select and
vertical speed modes. In the turn [to
325 degrees], passing through approxi-
mately 300 degrees, we encountered
moderate wake turbulence from a pre-
ceding aircraft. We did not recognize
at the time that the flight director roll
mode changed to control wheel steering
mode from heading select mode after
encountering the wake. … Neither of us
recognized that the aircraft went past
the assigned heading in control wheel
steering mode until air traffic control
issued a corrective heading and advised
‘no delay’ on our climb through Flight
Level 260 for traffic. Total course devia-
tion was about 70 degrees.”8
Flight Following
The Flight Deck Automation Issues
Web site <www.flightdeckautomation.
com>, funded by the FAA and operated
by a contractor for safety research by
the public, has accumulated evidence
of mode awareness/confusion while
tracking 94 human factors issues in
flight deck automation. Two of the
most relevant issues tracked regarding
flight safety foundation | AEroSafetyWorld | June 2008

mode awareness/confusion are “mode
awareness may be lacking” and “mode
selection may be incorrect.”
According to the Web site, the most
compelling evidence that inadequate
mode awareness can have fatal/severe
consequences is the accident investiga-
tion report from a 1992 Airbus A320
accident in France and the 1995 report
of a flight simulator experiment in
which 11 of 12 pilots deviated signifi-
cantly from the intended flight path
after researchers induced uncommand-
ed vertical mode changes, even though
each mode change was annunciated
normally. The A320 accident report
noted that “the abnormally high rate of
descent was the result of an uninten-
tional command on the part of the crew
because they believed the vertical mode
selected on the autopilot to be other
than that which was actually selected,”
the Web site said.
The strongest example of incor-
rect mode selection cited by the Web
site is the accident investigation report
from the 1979 DC-10 inadvertent stall
accident over Luxembourg. The U.S.
National Transportation Safety Board’s
accident report said, “When the captain
selected 320 kt into the autothrust sys-
tem speed window, he may have either
intentionally or unintentionally pulled
the autothrust system speed selector
knob. The action would have changed
the autothrust selection from the N1
mode to the airspeed mode. This in
turn would have caused the autopilot
IAS [indicated airspeed] HOLD mode
to disengage and revert automatically
to the vertical speed mode of operation.
… The autopilot commanded an in-
creasing angle-of-attack while attempt-
ing to maintain a preselected vertical
speed, which exceeded the limit thrust
performance capability of the aircraft at
higher altitudes.”9
www.flightsafety.org | AeroSafetyWorld | June 2008
Airworthiness Standards
In May 2006, an amendment to U.S.
Federal Aviation Regulations (FARs)
Part 25.1329, Flight Guidance System —
the first amendment since 1964 — be-
came effective. The European Aviation
Safety Agency and the FAA harmo-
nized these regulations. In the course of
rule making for these FARs in 2004, the
FAA said, “Studies have shown that lack
of sufficient flight crew awareness of
modes, transitions and reversions is a
significant safety vulnerability. … New-
er designs enable functions that were
not possible for automated systems
when the regulations were adopted. …
The newer designs also tend to be more
complex from the crew’s perspective,
and vulnerable to flight crew confusion
over mode behavior and transitions.”10
During design, manufacturers are
now asked to consider specific past
sources of mode awareness/confusion:
Pilots have confused knobs for setting
the airspeed command reference target
versus the heading target on the mode
control panel because knobs were not
differentiated by shape and position;
erroneous entries of targets have been
made by pilots operating a single
switch, such as a concentric rotary
switch, to select diverse categories of
targets; misinterpretation has resulted
from inconsistent arrangement of the
mode control panel, compared with the
arrangement of flight mode annuncia-
tions on the primary flight display (Fig-
ure 3, p. 34); pilots have mixed up the
autopilot and autothrust controls; and
pilots inadvertently have changed flight
modes because of the light control force
required to operate a switch.
In FAA Advisory Circular 25.1329B,
Approval of Flight Guidance Systems,
special attention has been given to op-
erationally relevant mode changes. The
FAA said, “Annunciation of sustained
FlightTECH
speed protection should be clear and
distinct to ensure flight crew awareness.
… The transition from an armed mode
to an engaged mode should provide
an additional attention-getting feature,
such as boxing and flashing on an
electronic display … for a suitable, but
brief, period (for example, 10 seconds)
to assist in flight crew awareness.”
Aural alerts may be warranted
when, for example, the autopilot holds
a sustained lateral control command
or pitch command to compensate for
an unusual operating condition, or the
airplane nears the limits of the autopilot
design in the pitch axis, roll axis or the
amount of trim applied unintentionally
in either axis. The advisory circular,
and some human factors specialists,
refer to such alerts as bark before bite.
“A timely alert enables the pilot to
manually disengage the autopilot and
take control of the airplane prior to an
automatic disengagement caused, for
example, by a lateral condition such as
asymmetric lift and/or drag caused by
airframe icing, fuel imbalance or asym-
metric thrust,” according to the AC.
Solutions at Hand
CAST worked earlier in this decade
with air carriers and manufacturers
on the mode awareness/confusion
issue to generate safety enhancements
as a “short-term tactical solution” for
reducing the risk of loss of control.
CAST safety enhancements appear in
a February 2003 report by the CAST
Joint Safety Implementation Team.11
One example is no. 36, which says, “De-
velop specific guidelines for eliminating
mode confusion. Implement guidelines
on new [airplane] type designs and
study the feasibility of implementing
guidelines on existing type designs.
Implement changes per the feasibil-
ity study. … To avoid problems due to
| 33
 FlightTECH

state. … To ensure flight crews have a compre-

Generic Primary Flight Display for Human Factors Research hensive knowledge of the automation system(s)
Autopilot functional operation, airlines/operators should
engaged Roll mode Pitch mode Pitch mode
indicator engaged1 engaged2 armed ensure that their training/standardization pro-
Flight ROLL PTCH Pilot flying grams emphasize these skills.”
director HDG VS indicator The ATA’s key recommendation was that
guidance NAV FLC
cues LAPPR ALT pilots deliberately scan the flight mode annun-
GA ALTS
VAPPR
ciations to determine whether autopilot and/
VGA or autothrust are engaged and in what modes
— not merely to confirm the result of each auto­
flight mode selection considering that so many
mode changes are designed to happen without
pilot action. Another suggested countermeasure
was collecting and analyzing all mode aware-
ness/confusion events, etc. through a pilot
voluntary reporting system and, if required,
proactively “changing the expectation” of pilots
by highlighting the identified issues in training.
Mode awareness/confusion also has been
addressed by the Flight Safety Foundation
Approach-and-Landing Accident Reduction Tool
Kit. Examples of the tool kit’s recommended
countermeasures are checking that the knob or
push-button is correct for the desired function
before each mode/target selection, monitoring
the flight mode annunciation and calling out
all mode changes in accordance with standard
operating procedures, and cross-checking the
altitude entered on the mode control panel with
the selected altitude shown on the primary flight
display.
The 2004 revision of the Airplane Upset
Recovery Training Aid also contains relevant
ALT = altitude hold mode; ALTS = altitude select mode; FLC = flight level change mode; information.12 An FSF safety seminar presenta-
GA = lateral go-around mode; HDG = heading select mode; LAPPR = lateral approach mode;
NAV = lateral navigation mode; PTCH = pitch hold mode; ROLL = roll hold mode;
tion by Boeing in October 2007 highlighted
VAPPR = vertical approach mode; VGA = vertical go-around mode; VS = vertical speed mode this training aid and cited several pilot-induced
Notes errors involving maneuvering at high altitude in
1. One engaged roll mode and one engaged pitch mode appear in green on the first line.
a mode that does not protect against thrust and
2. One armed roll mode and one armed pitch mode appear in white on the second line.
buffet margins.
3. Autothrust modes typically annunciated on the primary flight display were not included in
this example. “When using LNAV [lateral navigation]
Source: Langley Research Center, U.S. National Aeronautics and Space Administration mode during cruise, the mode provides real-
time bank angle–limiting functions and will
Figure 3
keep the commanded bank angle from exceed-
unexpected mode changes, automated flight sys- ing the currently available thrust limit,” Boeing
tem logic should be designed to be error-toler- said. “This protection is not available when
ant or, at a minimum, provide an alert when the LNAV mode is deactivated. Heading select
desired mode is in conflict with aircraft energy mode does not protect against too much bank.

34 | flight safety foundation | AEroSafetyWorld | June 2008


And often when maneuvering around
storms … crews have left the bank
angle setting at something used during
low-altitude operations. … A common
technique [in threat and error manage-
ment] is to set the mode control panel
bank-angle selector to 10 degrees when
at cruise.”13
On the Drawing Board
The focus of a team from the NASA
Langley Research Center and Rockwell
Collins reflected one of the major re-
search directions: in-depth human feed-
back for qualitative insights combined
with exhaustive mathematical probing of
flight guidance system models by other
software for quantitative validations
of mode logic and behavior. In the late
1990s, this team created its first soft-
ware model of a flight guidance system,
connected it to a desktop computer
simulation of a flight deck and reviewed
the mode behavior and human-machine
interface with avionics design engineers,
pilots and human factors specialists.
Their second strategy applied
software engineering, specifically two
formal analysis methods in which out-
puts of mathematical formulas change in
response to inputs of different variables,
called model checking and theorem
proving. This strategy enabled software-
based “exploration” of all possible
scenarios and combinations of modes —
how, for example, some pilot inputs are
ignored as irrelevant by the active mode
logic. These researchers said in 2003,
“Even though our [formal analysis of a
simplified model of a regional jet flight
guidance system] was only partial, we
were able to find hidden modes, ignored
operator inputs, unintended side ef-
fects, lack of feedback regarding current
modes, and surprises in how off-normal
modes can be entered and exited in our
example specification.”14
www.flightsafety.org | AeroSafetyWorld | June 2008
As one example of related activi-
ties by airframe manufacturers, Boeing
has been communicating through FSF
safety seminars and aviation human-
computer interface conferences its
efforts to rethink flight guidance system
design, test prototypes and provide
supplemental educational modules in
support of deeper pilot understanding
of existing automation behavior.
A clean-slate design for a future
flight guidance system has been pre-
sented at industry conferences. One
Boeing presentation, for example, said
that this new design has discarded the
concept of pilots memorizing rules for
each mode — a limitation imposed
decades ago by the avionics architec-
ture itself — with “indications directly
related to flight path behavior (e.g.,
CLIMB, LEFT TURN).”
By starting from scratch, the
designers gained the opportunity to
make each automated method of flight
conceptually correspond with the
manual method used by pilots; make
infrequent tasks as simple as common
tasks; clarify when flight is linked/un-
linked to strategic targets in the flight
management system or tactical targets
entered on the mode control panel; and
provide a “preview line” for tactical
target entries. They said, “In the new
design, approach, landing, go-around
and even taxi guidance use the same
modes and interfaces as up-and-away
flight, resulting in only seven modes
to cover the entire domain and provid-
ing an extreme level of simplicity and
consistency.” ●
Notes
1. Joshi, Anjali; Miller, Steven P.; Heimdahl,
Mats P.E. “Mode Confusion Analysis of
a Flight Guidance System Using Formal
Methods.” In proceedings of the 22nd
Digital Avionics Systems Conference in
Indianapolis, Indiana, U.S., October 2003.
FlightTECH
2. Boorman, Daniel J.; Mumaw, Randall J. “A
New Autoflight/FMS Interface: Guiding
Design Principles.” Paper presented to the
2004 International Conference on Human-
Computer Interaction in Aeronautics in
Toulouse, France, September 2004.
3. FAA Human Factors Team. “The Interfaces
Between Flightcrews and Modern Flight
Deck Systems.” June 18, 1996. Reprinted
by Flight Safety Foundation in the October
1996 Flight Safety Digest.
4. ATA Automation Subcommittee, Human
Factors Committee. “Potential Knowledge,
Policy or Training Gaps Regarding
Operation of FMS-Generation Aircraft –
Second Report.” June 1998.
5. Sherman, P.J.; Helmreich, R.L.; Merritt,
A. “National Culture and Flight Deck
Automation: Results of a Multination
Survey.” International Journal of Aviation
Psychology Volume 7/4, 1997. Cited on
<www.flightdeckautomation.com>.
6. NASA ASRS report no. 728889, February
2007.
7. NASA ASRS report no. 726182, February
2007.
8. NASA ASRS report no. 767601, December
2007.
9. NTSB. Aeromexico DC-10 Over
Luxembourg, November 11, 1979. Aircraft
Accident Report no. NTSB/AAR-80-10,
1980. Cited on <www.flightdeckautoma-
tion.com>.
10. FAA. “Safety Standards for Flight
Guidance Systems.” Notice of proposed
rule making no. 04-11. Aug. 13, 2004.
11. CAST. “Loss of Control (LOC) Joint Safety
Implementation Team Report.” Feb. 15,
2003.
12. Upset Recovery Industry Team. Airplane
Upset Recovery Training Aid, Revision 1.
Aug. 6, 2004.
13. Carbaugh, Dave. “Threat and Error
Management (TEM) and High Altitude
Operations.” Presentation to the Flight
Safety Foundation International Air Safety
Seminar in Seoul, Korea. October 2007.
14. Joshi et al.
| 35